SCO v. IBM

On March 7, 2003, the SCO Group (formerly known as Caldera Systems) filed a $1 billion lawsuit in the US against IBM for allegedly "devaluing" its version of the UNIX operating system. The amount of alleged damages was later increased to $3 billion, and then $5 billion. SCO claimed that IBM had, without authorization, contributed SCO's intellectual property to the codebase of the open source, Unix-likeLinux operating system. In May 2003 SCO Group sent letters to members of the Fortune 1000 and Global 500 companies warning them of the possibility of liability if they use Linux. Because of this, the stock price of SCO's stock (Nasdaq stock symbol SCOX) skyrocketed, although it has since returned to near its original level.

Since then, the claims and counter-claims made by both sides have escalated, with both IBM and Linux distributor Red Hat starting legal action against SCO, and SCO making threatening remarks toward Linux users who do not take out SCO UNIX licences.

On September 30, Judge Kimball granted the SCO Group's request for a delay until February 4, 2004, "to file any amended pleadings or add parties to this action". This pushes the start of the actual lawsuit back until 2005.

SCO has been reported as threatening to sue Linux users and even Linus Torvalds, head of the Linux kernel programming project. Computerworld reported Chris Sontag of SCO as saying:

"It's very extensive. It is many different sections of code ranging from five to 10 to 15 lines of code in multiple places that are of issue, up to large blocks of code that have been inappropriately copied into Linux in violation of our source-code licensing contract. That's in the kernel itself, so it is significant. It is not a line or two here or there. It was quite a surprise for us."

SCO refuses to allow access to the samples of code containing the alleged copyright violations except under a non-disclosure agreement (NDA). SCO's NDA would not only require that the signer keep confidential which lines of code SCO contested, but would also require that they hold confidential any information SCO told them, even if they already knew that information before being informed of it by SCO; all Linux kernel developers have considered this to be far too restrictive, so none of them have signed it. However, at SCO's annual reseller's convention in August of 2003 they revealed two short sections of code they alleged were copyright violations, and this code was later reprinted on the Heise website, a German computer magazine publisher.

On May 30, 2003, SCO Group's CEO Darl McBride was quoted as saying that the Linux kernel contained "hundreds of lines" of code from SCO's version of UNIX, and that SCO would reveal the code to other companies under NDA in July. [1] To put this into context, David Wheeler's SLOCCount estimates the size of the Linux 2.4.2 kernel as 2,440,919 source lines of code out of over 30 million physical source lines of code for a typical GNU/Linux distribution. Therefore, as per SCO's own estimate, the allegedly infringing code would make up about 0.001% of the total code of a typical GNU/Linux installation. [1] SCO has since upwardly revised this figure to over a million lines of code, however. [1]

SCO's major claims have now been reported as relating to the following components of the Linux kernel:

These claims flow from the accusation of breach of contract. The contract between IBM and AT&T (to which SCO claims to be successor in interest) allows IBM to use the SVR5 code, but the SVR5 code, plus any derivative works made from that code, must be held confidential by IBM. According to IBM's interpretation of the contract, and the interpretation published by AT&T in their "$ echo" newsletter in 1985, "derivative works" means any works containing SVR5 code. But according to SCO's interpretation, "derivative works" also includes any code built on top of SVR5, even if that does not contain, or even never contained, any SVR5 code. Thus, according to SCO, any AIX operating system code that IBM developed must be kept confidential, even if it contains nothing from SVR5.

that the Linux operating system was unlikely to contain UNIX code, as it had been written from scratch by hundreds of collaborators, with a well-documented provenance and revision history that was entirely in the public view;

that it made no technical sense to incorporate SCO UNIX code in Linux, as Linux had the technical features that are claimed to have been appropriated already implemented before SCO UNIX had them;

that even if Linux and SCO UNIX had some code in common, this did not necessarily mean that this code was copied to Linux from SCO UNIX -- perhaps the common pieces of code had been legitimately copied from another open source operating system, perhaps a BSD-derived one, or one of the historical Unix versions previously released by SCO;

that SCO (see Caldera Systems) had begun as a Linux company, and has added many Linux-like features to SCO UNIX, and any common code may have in fact been copied from Linux into SCO UNIX:

and furthermore, that if such reverse copying from Linux itself had occurred, that the distribution of SCO UNIX binaries containing GPL'd contributions may therefore require SCO either to remove their product from the market until GPL'd code has been removed, or to release their source code under the GPL to their users;

that even if Linux did contain some UNIX code, the SCO Group had lost any right to sue IBM for trade secret or other intellectual property infringement by distributing Linux itself (their Caldera distribution) under the GNU General Public License (GPL), both before and after their announcement;

and finally, that even if SCO were to have a valid claim against IBM, their distribution of Linux under the GPL precludes them from pursuing any other user of Linux.

SCO and its officers have been the subject of much criticism by the free software community, some of whom have stated that SCO's behavior may amount to illegal conduct. Indeed, SEC filings reveal that senior SCO executives dumped their personal holdings in SCO shortly after counter-suits were filed by IBM and RedHat, lending credence to the idea that the lawsuit's primary purpose is manipulation of SCO's stock price. SCO Group's CEO Darl McBride has been the subject of particular vituperation.

"Quite frankly, I found it mostly interesting in a Jerry Springer kind of way. White trash battling it out in public, throwing chairs at each other. SCO crying about IBM's other women. ... Fairly entertaining."

In an interview on June 23rd, Torvalds responded to SCO's allegation that Linux development had no process for vetting kernel contributions:

"I allege that SCO is full of it, and that the Linux process is already the most transparent process in the whole industry. Let's face it, nobody else even comes close to being as good at showing the evolution and source of every single line of code out there."

The Inquirer reported on June 15, 2003, that an unnamed Linux kernel programmer has written to SCO, threatening action based on their distribution of a Linux distribution that, according to their own claims, contains code not licensed under the GPL. According to the letter reproduced there, the programmer claimed that SCO's doing so was an infringement of his own copyright. SCO's response to this letter is not known.

On June 25, Eben Moglen, the counsel for the Free Software Foundation, released a fuller statement regarding the SCO lawsuit. In this statement, he reiterates many of the points made above, and states that:

"As to its trade secret claims, which are the only claims actually made in the lawsuit against IBM, there remains the simple fact that SCO has for years distributed copies of the kernel, Linux, as part of GNU/Linux free software systems. [...] There is simply no legal basis on which SCO can claim trade secret liability in others for material it widely and commercially published itself under a license that specifically permitted unrestricted copying and distribution."

"There is absolute difficulty with this line of argument which ought to make everybody in the world aware that the letters that SCO has put out can be safely put in the wastebasket," ...

"From the moment that SCO distributed that code under the GNU General Public License, they would have given everybody in the world the right to copy, modify and distribute that code freely," ... "From the moment SCO distributed the Linux kernel under GPL, they licensed the use. Always. That's what our license says."

Apparently noticing the incongruity of their selling a Linux distribution while suing IBM for stealing their intellectual property and giving it to the developers of that operating system, the SCO Group then announced on May 14 that they would no longer distribute Linux. According to their press release, "SCO will continue to support existing SCO Linux and Caldera OpenLinux customers and hold them harmless from any SCO intellectual property issues regarding SCO Linux and Caldera OpenLinux products."

[ Congress shall have power] to promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries.

SCO Claim that this pre-empts the GNU General Public License, since the main purpose of the GPL is to remove exclusive rights, and promote rights for all, that the GPL is therefore a violation of the that part of the US Constitution. This may put into question the legality of transferring copyrights and contributing to the public domain, two activities which have long been "legal" in the United States.

If a court agreed with SCO on this, Section 7 of the GPL would then prevent Linux from being distributed in the United States.

Novell entered the controversy by publishing on May 28 a press release concerning the SCO Group's ownership of UNIX. "To Novell's knowledge, the 1995 agreement governing SCO's purchase of UNIX from Novell does not convey to SCO the associated copyrights," a letter to the SCO Group's CEODarl McBride said in part. "We believe it unlikely that SCO can demonstrate that it has any ownership interest whatsoever in those copyrights. Apparently you share this view, since over the last few months you have repeatedly asked Novell to transfer the copyrights to SCO, requests that Novell has rejected."

SCO later claimed to have discovered an amendment to their contract with Novell transferring partial ownership to SCO. Novell stated that the amendment "appears to bear a valid Novell signature, and the language, though convoluted, seems to support SCO's claim that ownership of some copyrights for Unix did transfer to SCO"; Novell also said that it could not find its own copy of the amendment.

But in subsequent letters to SCO that Novell released on December 22, Joseph LaSala Jr, Novell's general counsel, argued that the amendment provided for a copyright transfer only under certain conditions that SCO has allegedly failed to meet.

SCO was quick to dismiss Novell's claims. "We see this as a fraudulent filing of copyright notices ... and we'll take the appropriate measures as necessary with our legal team," SCO CEO Darl McBride said during a conference call held to discuss his company's most recent financial results.

Univention GmbH, a Linux integrator, reported on May 30, 2003 it was granted an injunction by a Bremen court under German competition law that prohibits the SCO Group's German division from saying that Linux contains illegally obtained SCO intellectual property. If the SCO Group continues to express this position, they would have to pay a fine of 250,000 Euros. A similar injunction was sought around the same time in Poland.

On July 23, Open Source Victoria announced that they had filed a complaint with the Australian Competition and Consumer Commission, "asking the ACCC to investigate the SCO Group's activities in light of their unsubstantiated claims and their extortive legal threats for money against possibly hundreds of thousands of Australians."

As of June 17, 2003, CNET News.com reported that SCO has increased its claims of damage to $3 billion, and has stated that the read-copy-update code in the Linux kernel is an example of code that infringes its rights. This technique is widely believed to have been developed at Sequent Computer Systems, who were then bought by IBM, who holds several patents (including 5,442,758) on this technique.

On June 23, 2003, SCO sent out a letter announcing that it would not be suing its own Linux customers. [1] In the letter, it states:

SCO will continue to support our SCO Linux and OpenLinux customers and partners who have previously implemented those products and we will hold them harmless from any SCO intellectual property issues regarding Linux.

Some observers have stated that in doing so, SCO may have granted the same rights to other Linux users who obtained a copy of Linux from an SCO partner under the terms of the GPL. Others have stated that to "hold someone harmless" is different from a grant of rights, and that SCO has not made a grant of rights in writing this letter. Others believe that this letter is moot, as a grant of rights was made by SCO by the act of releasing the software under the GPL in the first place. This action may also signal the grounds for a GPL violation suit against SCO as it is seeking different terms of distribution of works for its own customers than other recipients of the same work.

On July 21, 2003, SCO announced that it intends to sell binary-only licences to use the free Linux operating system which will remove the threat of litigation from licence-holders. Linux advocates reacted by stating that SCO has no basis for this action, as their claims were still disputed in court, and that the terms of the GPL seemed to indicate that doing this may cause SCO to forfeit their rights to distribute Linux or Linux-derived code in any form.

On August 5 2003, SCO's Darl McBride announced the company's final licensing fees requested from end users for the use of Linux; a single-CPU server license will cost US $699 until October 15, 2003, and $1,399 afterward, while licenses for desktop and embedded systems will currently cost US $199 and US $32, respectively. [1][1] Prices for server systems with more than one CPU range from US $1,149 for two CPUs to US $2,499 for four CPUs and US $4,999 for eight CPUs, with each additional CPU being priced at US $749. All of these prices, including the ones for desktop and embedded systems, are scheduled to be increased on October 15, 2003.

On August 4, 2003, it was reported that Red Hat has filed a legal action against SCO ([1], [1]). According to the filing, Red Hat has requested that the court make:

a permanent injunction against SCO's campaign against Linux

a number of declaratory judgments

that Red Hat has not violated SCO's copyright

that Red Hat has not violated SCO's trade secrets rights

and several other claims for relief

SCO replied with both a press release and two letters to Red Hat on the same day ([1]); their claims are reiterated in the press release ("Linux includes source code that is a verbatim copy of UNIX and carries with it no warranty or indemnification. SCO's claims are true and we look forward to proving them in court."), and the allegations made by Red Hat are denied ("SCO has not been trying to spread fear, uncertainty and doubt to end users.")

The letters to Red Hat also hint at possible legal retaliations against Red Hat, saying:

"Of course, we will prepare our legal response as required by your complaint. Be advised that our response will likely include counterclaims for copyright infringement and conspiracy. I must say that your decision to file legal action does not seem conducive to the long-term survivability of Linux."

The Linux distributor SuSE, a member of the UnitedLinux consortium together with SCO Group, later expressed support for Red Hat's initiative, stating in a press release:

"SCO has already been halted in Germany and we applaud Red Hat's actions to help end their activities in the US -- and beyond. We applaud their efforts to restrict the rhetoric of the SCO Group -- and the FUD they are trying to instill -- and will determine quickly what actions SuSE can take to support Red Hat in their efforts." [1]

In response to these counterclaims, SCO has asserted that the GPL is unenforcible, void, and violates the United States Constitution. If these claims are true, then the GPL'd applications that SCO continues to distribute (like Samba) are being distributed without the permission of the copyright owners of those applications (since the permission was the GPL itself), which would be illegal. Thus some speculate that, in order to remain legally consistent, SCO will claim that software that has been GPL'd is actually in the public domain.

The discovery portion of the lawsuit has been dragging on for an unusual amount of time. The basis for SCO's suit is that any code developed on top of SVR5 is a derivative work of SVR5 (which would include AIX), and that IBM has publicly admitted to contributing AIX code to the Linux kernel. Since SCO has never seen the AIX code, it has, as part of the discovery process, deposed IBM for the AIX code, so that it can compare AIX code to Linux kernel code. IBM, rejecting SCO's concept of derivative work, has deposed SCO for which lines of code it claims are infringing. SCO has responded that it can't determine which code is infringing until it has had the chance to look at the AIX code.

On October 1, 2003 the SCO Group announced that they would be revoking SGI's UNIX license for code it contributed to the kernel Linux. The source of this code was identified after it was shown at a reseller show.

Alleged copies of these letters were posted online at Groklaw and LWN. The letters give the names of 65 files in the Linux source code tree which supposedly incorporate "copyrighted binary interfaces". A rebuttal by Linus Torvalds was then posted on Groklaw.

On March 1, 2004, SCO announced it had reached a license agreement with EV1Servers.net, which allowed EV1Servers to use some of SCO's "intellectual property". SCO's Blake Stowell claimed the deal was worth upward of "seven figures" ($1,000,000) while a few days later EV1Servers CEO Robert Marsh claimed the amount was much lower. The exact amount was required to remain secret under terms of the agreement.

On March 3, 2004, SCO sued AutoZone for "commercial use of Linux," according to Darl McBride. Then they sued DaimlerChrysler for allegedly not complying with the terms of their Unix license as originally purchased from AT&T. Published reports say that by examining deleted material in the Microsoft Word files containing the complaint, SCO was originally going to sue Bank of America instead of DaimlerChrysler.

On March 4, 2004, a leaked SCO internal email detailed how Microsoft has paid SCO over $100 million, via the Baystar deal and other means [1]. Blake Stowell of SCO confirmed the memo was real [1]. Baystar claimed the deal was suggested by Microsoft, but that no money for it came directly from them. Microsoft, at the time, had $550 million invested with Baystar. [1].

An IDG News Service interview with Robert Marsh, CEO of EV1Servers.net, was published on March 25, 2004. [1] He expressed his regret at signing an agreement with SCO: "Would I do it again? No. I'll go on the record as saying that." Postings to the EV1Servers.net user forums revealed that some of the larger customers were consulted beforehand and wanted EV1 to make the deal out of fear that a lawsuit from SCO could shut down their servers. However, a large and vocal opposition was not consulted and made its displeasure known afterward. Some say Marsh publicizing his regret will harm SCO's cause more than if they hadn't signed the deal at all, while others feel he is just trying to talk nice to avoid losing any more customers.

On April 22, 2004, The New York Times (p.C6) reported that BayStar Capital, a private hedge fund which had arranged for $50M in funding for SCO in October 2003, was asking for its $20M back. The remainder of the $50M was from Royal Bank of Canada. In 2003, BayStar looked at SCO on the recommendation of Microsoft, according to Lawrence R. Goldfarb, managing partner of Baystar Capital: "It was evident that Microsoft had an agenda". The April 15, 2004 letter to SCO asserted that SCO's management had breached certain provisions (detailed above) of the investment agreement with BayStar; Goldfarb stated that if SCO reformed its management practices (spending and focus), "BayStar might keep its funds in SCO".

In an article that appeared at linuxworld.com in July 2004, several claims were revealed from court filings in the SCO Group lawsuit. Most notably, SCO Group claims that the use of the Executable and Linking Format (ELF) in Linux infringes on SCO copyrights. ELF originally was defined as part of Unix System V, but in 1995, the format was published as an industry standard. SCO Group claims that the Tool Interface Standard Committee (TISC), which published the standard, overstepped its rights in granting a blanket non-exclusive license to use ELF. Novell, the owners of System V at the time of the ELF standard's publication, were on the standards committee and presumably agreed to the license terms. Since ELF is used throughout Linux and GNU operating systems, restricting the use of ELF would be a major blow to Linux. The fact the Novell was on the TISC seems damaging to SCO Group's claims, but as of this writing, no court has issued a ruling on the validity of the claims.